Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    17/12/2024, 02:44

General

  • Target

    e87659b8e46576271815dff623ad329ba00b2701fc42a4b631c4d70f42962a06.exe

  • Size

    2.8MB

  • MD5

    4151edefdf6c76d06b5d81845575876a

  • SHA1

    93b891f61000a816830941eed9b7f1e7548e8815

  • SHA256

    e87659b8e46576271815dff623ad329ba00b2701fc42a4b631c4d70f42962a06

  • SHA512

    1ce20434ff9ded386dd74d06a938699ef2f1d1c7ff310989893b63d7d64c3f73d21ac65e14408c8c3a84c5df132632f30d6787e65f200e4bf327e3cb0d3479f3

  • SSDEEP

    49152:6jHqiQyBFWr7HkXfuMWfxEN2dLJ276vqu14t6:6jKYB4r7EXfuZLdlc6vXI

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Extracted

Family

stealc

Botnet

default_valenciga

C2

http://185.215.113.17

Attributes
  • url_path

    /2fb6c2cc8dce150a.php

Extracted

Family

lumma

C2

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://sordid-snaked.cyou/api

https://awake-weaves.cyou/api

https://wrathful-jammy.cyou/api

https://debonairnukk.xyz/api

https://diffuculttan.xyz/api

https://effecterectz.xyz/api

https://deafeninggeh.biz/api

https://immureprech.biz/api

https://shineugler.biz/api

Extracted

Family

lumma

C2

https://shineugler.biz/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 6 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 14 IoCs
  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 26 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies system certificate store 2 TTPs 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e87659b8e46576271815dff623ad329ba00b2701fc42a4b631c4d70f42962a06.exe
    "C:\Users\Admin\AppData\Local\Temp\e87659b8e46576271815dff623ad329ba00b2701fc42a4b631c4d70f42962a06.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1224
    • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
      "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2836
      • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
        "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:1644
      • C:\Users\Admin\AppData\Local\Temp\1001527001\alexshlu.exe
        "C:\Users\Admin\AppData\Local\Temp\1001527001\alexshlu.exe"
        3⤵
        • Executes dropped EXE
        PID:2804
      • C:\Users\Admin\AppData\Local\Temp\1003013001\AllNew.exe
        "C:\Users\Admin\AppData\Local\Temp\1003013001\AllNew.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1700
        • C:\Users\Admin\AppData\Local\Temp\23a0892ef8\Gxtuum.exe
          "C:\Users\Admin\AppData\Local\Temp\23a0892ef8\Gxtuum.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2180
      • C:\Users\Admin\AppData\Local\Temp\1004899001\am209.exe
        "C:\Users\Admin\AppData\Local\Temp\1004899001\am209.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1312
        • C:\Users\Admin\AppData\Local\Temp\fc9e0aaab7\defnur.exe
          "C:\Users\Admin\AppData\Local\Temp\fc9e0aaab7\defnur.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1740
          • C:\Windows\SysWOW64\rundll32.exe
            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
            5⤵
            • Blocklisted process makes network request
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:2532
      • C:\Users\Admin\AppData\Local\Temp\1005242001\v_dolg.exe
        "C:\Users\Admin\AppData\Local\Temp\1005242001\v_dolg.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2432
      • C:\Users\Admin\AppData\Local\Temp\1006252001\roblox.exe
        "C:\Users\Admin\AppData\Local\Temp\1006252001\roblox.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2472
        • C:\Users\Admin\AppData\Local\Temp\onefile_2472_133788770909320000\stub.exe
          C:\Users\Admin\AppData\Local\Temp\1006252001\roblox.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1556
      • C:\Users\Admin\AppData\Local\Temp\1006343001\goldlummaa.exe
        "C:\Users\Admin\AppData\Local\Temp\1006343001\goldlummaa.exe"
        3⤵
        • Executes dropped EXE
        PID:2884
      • C:\Users\Admin\AppData\Local\Temp\1006591001\sintv.exe
        "C:\Users\Admin\AppData\Local\Temp\1006591001\sintv.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1328
        • C:\Windows\System32\certutil.exe
          "C:\Windows\System32\certutil.exe" -silent -importPFX -p "" -f "C:\Users\Admin\AppData\Local\Temp\tmp4942.tmp"
          4⤵
            PID:2232
        • C:\Users\Admin\AppData\Local\Temp\1006664001\Out.exe
          "C:\Users\Admin\AppData\Local\Temp\1006664001\Out.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1016
          • C:\Users\Admin\AppData\Local\Temp\1006664001\Out.exe
            "C:\Users\Admin\AppData\Local\Temp\1006664001\Out.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            PID:2668

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe

      Filesize

      307KB

      MD5

      68a99cf42959dc6406af26e91d39f523

      SHA1

      f11db933a83400136dc992820f485e0b73f1b933

      SHA256

      c200ddb7b54f8fa4e3acb6671f5fa0a13d54bd41b978d13e336f0497f46244f3

      SHA512

      7342073378d188912b3e7c6be498055ddf48f04c8def8e87c630c69294bcfd0802280babe8f86b88eaed40e983bcf054e527f457bb941c584b6ea54ad0f0aa75

    • C:\Users\Admin\AppData\Local\Temp\1001527001\alexshlu.exe

      Filesize

      809KB

      MD5

      9821fa45714f3b4538cc017320f6f7e5

      SHA1

      5bf0752889cefd64dab0317067d5e593ba32e507

      SHA256

      fd9343a395c034e519aea60471c518edbd8cf1b8a236ec924acf06348e6d3a72

      SHA512

      90afec395115d932ea272b11daa3245769bdcc9421ecd418722830259a64df19ed7eacca38000f6a846db9f4363817f13232032ab30f2ab1aa7e88097361d898

    • C:\Users\Admin\AppData\Local\Temp\1003013001\AllNew.exe

      Filesize

      429KB

      MD5

      c07e06e76de584bcddd59073a4161dbb

      SHA1

      08954ac6f6cf51fd5d9d034060a9ae25a8448971

      SHA256

      cf67a50598ee170e0d8596f4e22f79cf70e1283b013c3e33e36094e1905ba8d9

      SHA512

      e92c9fcd0448591738daedb19e8225ff05da588b48d1f15479ec8af62acd3ea52b5d4ba3e3b0675c2aa1705185f5523dcafdf14137c6e2984588069a2e05309f

    • C:\Users\Admin\AppData\Local\Temp\1004899001\am209.exe

      Filesize

      429KB

      MD5

      ce27255f0ef33ce6304e54d171e6547c

      SHA1

      e594c6743d869c852bf7a09e7fe8103b25949b6e

      SHA256

      82c683a7f6e0b4a99a6d3ab519d539a3b0651953c7a71f5309b9d08e4daa7c3c

      SHA512

      96cfafbab9138517532621d0b5f3d4a529806cfdf6191c589e6fb6ebf471e9df0777fb74e9abbfe4e8cd8821944ad02b1f09775195e190ee8ca5d3fd151d20d9

    • C:\Users\Admin\AppData\Local\Temp\1005242001\v_dolg.exe

      Filesize

      3.6MB

      MD5

      378706614b22957208e09fc84fceece8

      SHA1

      d35e1f89f36aed26553b665f791cd69d82136fb8

      SHA256

      df6e6d5bead4aa34f8e0dd325400a5829265b0f615cd1da48d155cc30b89ad6d

      SHA512

      bef7a09ce1ffd0a0b169a6ec7c143ca322c929139ca0af40353502ae22fed455fe10a9b80ba93cc399a88add94f921b7aa801033ddae351f8f8d477781ca476e

    • C:\Users\Admin\AppData\Local\Temp\1006252001\roblox.exe

      Filesize

      10.7MB

      MD5

      6898eace70e2da82f257bc78cb081b2f

      SHA1

      5ac5ed21436d8b4c59c0b62836d531844c571d6d

      SHA256

      bcdd8b7c9ec736765d4596332c0fec1334b035d4456df1ec25b569f9b6431a23

      SHA512

      ca719707417a095fe092837e870aefc7e8874ef351e27b5b41e40f46a9e2f6cb2ba915858bc3c99a14c2f1288c71c7ddd9c2adee6588d6b43cd3ba276e1585d2

    • C:\Users\Admin\AppData\Local\Temp\1006343001\goldlummaa.exe

      Filesize

      396KB

      MD5

      876bf2dec67ea8626322d2c268219d76

      SHA1

      ecb0c0cd486733491804a05cf387f2d04d5e2279

      SHA256

      08d37bbc1881f5fbfdcc84e3270320bb4d03a3ad4fcdf1d996c9de0ca8f2b425

      SHA512

      9268392683a9962143f987f069d97016abd1ccd61bb67aa8e3f8d9c4b7aa6168d3c01884ce9023831216b8710eddee2d52fcb3c84dbacefe94cb28fa661b6a79

    • C:\Users\Admin\AppData\Local\Temp\1006591001\sintv.exe

      Filesize

      4.5MB

      MD5

      38fcaa23700e62fb0b3fc2591f82cc80

      SHA1

      abedd6ec573a6fede05d15920f3ac3763062c75c

      SHA256

      fb829a6a8535a443932cd167e8301b5e74c60702b5f7fade7e9f13a736ce72b0

      SHA512

      5da88a61c716a9891cb225f36f275040d69915c4c731c2a5c042d5c997ca39241a3e9d6646569468d477f47db42462c21b58f2de7f56a84cb145e6cee478eeef

    • C:\Users\Admin\AppData\Local\Temp\1006664001\Out.exe

      Filesize

      2.5MB

      MD5

      7ff947867bc70055adffa2164a741b01

      SHA1

      cff424168c2f6bcef107ebc9bd65590f3ead76ae

      SHA256

      b6d6628d2dc7dea808eef05180c27abe10a1af245d624aacdacccc52a1eb7b40

      SHA512

      da507d1847056d0dc2c122c45ecbea4901a81c06890bcdbffc2f18ad4b96f0ac2c2fa9ebde1a315828c74a97af653062a8c50ce70c9b6d6966c48871150747ee

    • C:\Users\Admin\AppData\Local\Temp\Cab542A.tmp

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\Local\Temp\Tar543D.tmp

      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • C:\Users\Admin\AppData\Local\Temp\Tmp48E3.tmp

      Filesize

      2KB

      MD5

      28fc139ec2d53ccea82aba253f5f405e

      SHA1

      71069ccc7e53fb8b2cbcbbd478a78821010bb6ef

      SHA256

      148987f7e201defbe41fa7de3ec8909f9400afdc1b38dac405aa1917cefff8cd

      SHA512

      ae4c7db5970ae265049e302b0c880f2f92e8dafc0e671b1e863aadcbbdbd5bec5658c002abaab35b5a2955effe9427ad2305857188ee6a4012feb83df2acfb57

    • C:\Users\Admin\AppData\Local\Temp\onefile_2472_133788770909320000\python310.dll

      Filesize

      4.3MB

      MD5

      c80b5cb43e5fe7948c3562c1fff1254e

      SHA1

      f73cb1fb9445c96ecd56b984a1822e502e71ab9d

      SHA256

      058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20

      SHA512

      faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81

    • C:\Users\Admin\AppData\Local\Temp\onefile_2472_133788770909320000\stub.exe

      Filesize

      16.1MB

      MD5

      d09a400f60c7a298e884f90539e9c72f

      SHA1

      41582ba130bef907e24f87534e7a0fdd37025101

      SHA256

      700962aa295e2fa207ff522e2f5ca051a2929eb6f252d42c9cb0a56a4f084bfe

      SHA512

      d8ba2859bb2ea109c1ca33cb924e40bf61db79aefb59324101d9f47a08835d86834790d3bc6bad4151a561ef82265b32d5111bc80f95dce769c5eb4da5116cc9

    • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\44CBF10ADA24FE3121D5AA13B1BA7B5EF4AFD89D

      Filesize

      1KB

      MD5

      ae54a540d7a5e4eed26caa8e5ce6b01e

      SHA1

      5369e13d9638d6b1332cd584494496b9338ff09d

      SHA256

      4f1ee7e382702da70ea3debb4a8836932b17d1094e193795e788b0e2f6394a22

      SHA512

      c259fd7d3ec7ddbbaf6da99c16e9498c0e3883d5347dd5c9cb9dc2beec9cc94146d494a58169f96e0b0b2d881236eedb0c9a6a3d5cbd3625a26dfc423b8006f6

    • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\44CBF10ADA24FE3121D5AA13B1BA7B5EF4AFD89D

      Filesize

      1KB

      MD5

      1ed31ac29ea8c31d081132fa2a32b2ad

      SHA1

      423e7571672c914a885fec7fe4eecdade3c87fb0

      SHA256

      7dc7aacb2b961182a57b4aaa792b1ede09e04f32e33252ab070bdb67d198c5ed

      SHA512

      b4b0c45f7df949675f7e24588adb3400cdb0c82526db830e114d56feb704cb3ba306110a31752635bd44ddf0fbb51bcaa935f169c0fbe5ca3dbcb0c7577285a6

    • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll

      Filesize

      124KB

      MD5

      0d3418372c854ee228b78e16ea7059be

      SHA1

      c0a29d4e74d39308a50f4fd21d0cca1f98cb02c1

      SHA256

      885bf0b3b12b77ef3f953fbb48def1b45079faa2a4d574ee16afdbafa1de3ac7

      SHA512

      e30dced307e04ae664367a998cd1ba36349e99e363f70897b5d90c898de2c69c393182c3afba63a74956b5e6f49f0635468e88ed31dd1e3c86c21e987ddd2c19

    • \ProgramData\mozglue.dll

      Filesize

      593KB

      MD5

      c8fd9be83bc728cc04beffafc2907fe9

      SHA1

      95ab9f701e0024cedfbd312bcfe4e726744c4f2e

      SHA256

      ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

      SHA512

      fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

    • \ProgramData\nss3.dll

      Filesize

      2.0MB

      MD5

      1cc453cdf74f31e4d913ff9c10acdde2

      SHA1

      6e85eae544d6e965f15fa5c39700fa7202f3aafe

      SHA256

      ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

      SHA512

      dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

    • \Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

      Filesize

      2.8MB

      MD5

      4151edefdf6c76d06b5d81845575876a

      SHA1

      93b891f61000a816830941eed9b7f1e7548e8815

      SHA256

      e87659b8e46576271815dff623ad329ba00b2701fc42a4b631c4d70f42962a06

      SHA512

      1ce20434ff9ded386dd74d06a938699ef2f1d1c7ff310989893b63d7d64c3f73d21ac65e14408c8c3a84c5df132632f30d6787e65f200e4bf327e3cb0d3479f3

    • memory/1224-19-0x0000000006740000-0x0000000006A54000-memory.dmp

      Filesize

      3.1MB

    • memory/1224-17-0x00000000001C0000-0x00000000004D4000-memory.dmp

      Filesize

      3.1MB

    • memory/1224-5-0x00000000001C0000-0x00000000004D4000-memory.dmp

      Filesize

      3.1MB

    • memory/1224-18-0x0000000006740000-0x0000000006A54000-memory.dmp

      Filesize

      3.1MB

    • memory/1224-3-0x00000000001C0000-0x00000000004D4000-memory.dmp

      Filesize

      3.1MB

    • memory/1224-2-0x00000000001C1000-0x00000000001EF000-memory.dmp

      Filesize

      184KB

    • memory/1224-1-0x0000000077230000-0x0000000077232000-memory.dmp

      Filesize

      8KB

    • memory/1224-0-0x00000000001C0000-0x00000000004D4000-memory.dmp

      Filesize

      3.1MB

    • memory/1328-274-0x0000000000910000-0x0000000000DA0000-memory.dmp

      Filesize

      4.6MB

    • memory/1556-288-0x000000013F850000-0x00000001408B9000-memory.dmp

      Filesize

      16.4MB

    • memory/1644-88-0x0000000061E00000-0x0000000061EF3000-memory.dmp

      Filesize

      972KB

    • memory/1644-188-0x00000000008D0000-0x0000000000B31000-memory.dmp

      Filesize

      2.4MB

    • memory/1644-43-0x00000000008D0000-0x0000000000B31000-memory.dmp

      Filesize

      2.4MB

    • memory/2432-161-0x0000000000400000-0x0000000000C4D000-memory.dmp

      Filesize

      8.3MB

    • memory/2432-160-0x0000000000400000-0x0000000000C4D000-memory.dmp

      Filesize

      8.3MB

    • memory/2432-163-0x0000000000400000-0x0000000000C4D000-memory.dmp

      Filesize

      8.3MB

    • memory/2432-164-0x0000000000400000-0x0000000000C4D000-memory.dmp

      Filesize

      8.3MB

    • memory/2432-162-0x0000000000400000-0x0000000000C4D000-memory.dmp

      Filesize

      8.3MB

    • memory/2432-372-0x0000000000400000-0x0000000000C4D000-memory.dmp

      Filesize

      8.3MB

    • memory/2432-260-0x0000000000400000-0x0000000000C4D000-memory.dmp

      Filesize

      8.3MB

    • memory/2472-413-0x000000013F150000-0x000000013FC22000-memory.dmp

      Filesize

      10.8MB

    • memory/2472-373-0x000000013F150000-0x000000013FC22000-memory.dmp

      Filesize

      10.8MB

    • memory/2668-382-0x00000000000B0000-0x0000000000106000-memory.dmp

      Filesize

      344KB

    • memory/2668-384-0x00000000000B0000-0x0000000000106000-memory.dmp

      Filesize

      344KB

    • memory/2668-379-0x00000000000B0000-0x0000000000106000-memory.dmp

      Filesize

      344KB

    • memory/2668-381-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

      Filesize

      4KB

    • memory/2668-414-0x00000000000B0000-0x0000000000106000-memory.dmp

      Filesize

      344KB

    • memory/2836-374-0x0000000000240000-0x0000000000554000-memory.dmp

      Filesize

      3.1MB

    • memory/2836-25-0x0000000000240000-0x0000000000554000-memory.dmp

      Filesize

      3.1MB

    • memory/2836-22-0x0000000000241000-0x000000000026F000-memory.dmp

      Filesize

      184KB

    • memory/2836-23-0x0000000000240000-0x0000000000554000-memory.dmp

      Filesize

      3.1MB

    • memory/2836-44-0x0000000000240000-0x0000000000554000-memory.dmp

      Filesize

      3.1MB

    • memory/2836-86-0x0000000000240000-0x0000000000554000-memory.dmp

      Filesize

      3.1MB

    • memory/2836-134-0x0000000000240000-0x0000000000554000-memory.dmp

      Filesize

      3.1MB

    • memory/2836-138-0x0000000000240000-0x0000000000554000-memory.dmp

      Filesize

      3.1MB

    • memory/2836-142-0x0000000000240000-0x0000000000554000-memory.dmp

      Filesize

      3.1MB

    • memory/2836-258-0x0000000000240000-0x0000000000554000-memory.dmp

      Filesize

      3.1MB

    • memory/2836-159-0x0000000006950000-0x000000000719D000-memory.dmp

      Filesize

      8.3MB

    • memory/2836-241-0x0000000006950000-0x000000000719D000-memory.dmp

      Filesize

      8.3MB

    • memory/2836-42-0x0000000006330000-0x0000000006591000-memory.dmp

      Filesize

      2.4MB

    • memory/2836-74-0x0000000000240000-0x0000000000554000-memory.dmp

      Filesize

      3.1MB

    • memory/2836-21-0x0000000000240000-0x0000000000554000-memory.dmp

      Filesize

      3.1MB

    • memory/2836-415-0x0000000000240000-0x0000000000554000-memory.dmp

      Filesize

      3.1MB

    • memory/2836-416-0x0000000000240000-0x0000000000554000-memory.dmp

      Filesize

      3.1MB

    • memory/2836-417-0x0000000000240000-0x0000000000554000-memory.dmp

      Filesize

      3.1MB

    • memory/2836-418-0x0000000000240000-0x0000000000554000-memory.dmp

      Filesize

      3.1MB

    • memory/2836-419-0x0000000000240000-0x0000000000554000-memory.dmp

      Filesize

      3.1MB

    • memory/2836-420-0x0000000006330000-0x0000000006591000-memory.dmp

      Filesize

      2.4MB

    • memory/2836-421-0x0000000006330000-0x0000000006591000-memory.dmp

      Filesize

      2.4MB

    • memory/2836-422-0x0000000000240000-0x0000000000554000-memory.dmp

      Filesize

      3.1MB

    • memory/2836-423-0x0000000000240000-0x0000000000554000-memory.dmp

      Filesize

      3.1MB

    • memory/2836-424-0x0000000000240000-0x0000000000554000-memory.dmp

      Filesize

      3.1MB

    • memory/2836-425-0x0000000000240000-0x0000000000554000-memory.dmp

      Filesize

      3.1MB

    • memory/2836-426-0x0000000000240000-0x0000000000554000-memory.dmp

      Filesize

      3.1MB

    • memory/2836-427-0x0000000000240000-0x0000000000554000-memory.dmp

      Filesize

      3.1MB